Re: Validation of Packet Too Big Payload using Echo Request

[Prabhakar Lakhera <[e-mail]>]

Hi,

I believe it is ok to leave the RFC 8201 as is.
It is the test that needs to be looked at.

Inline:

On Tue, Jan 28, 2020 at 3:10 AM <[e-mail] <mailto:[e-mail]>> wrote:

>> The IPv6 Ready Logo Committee updated testing to include a test for validating the Packet Too Big message content based on the following part of 8201.
>> 
>> "Nodes should appropriately validate the payload of ICMPv6 PTB
>>   messages to ensure these are received in response to transmitted
>>   traffic (i.e., a reported error condition that corresponds to an IPv6
>>   packet actually sent by the application) per [ICMPv6]."
>> 
>> I've included the steps below used to verify the IPv6 implementation validates the Packet Too Big.
>> 
>> Step
>> Action
>> Expected Behavior
>> 1. TR1 forwards an Echo Request from TN2 to the NUT.  The packet size is 1500 octets.
>> The NUT should respond without fragmenting the packet to the Echo Request using TR1 as a first hop.

Please note, that for most implementations ICMPv6 Echo Reply are not generated by some application.
They are generated by the system by reflecting the ICMPv6 Echo Requests and are sent unreliably and without keeping any state.

On the other hand, for UDP, one can validate the ports. For TCP one can also compare sequence numbers.

The point is the different level of validation might be possible with some protocols and for some protocols, like being tested for ICMPv6, it is not.

Changing the behavior for stack implementation for the test would require stack to become stateful and not just fire and forget ICMPv6 replies.
It also would require the replies to be held onto sometime. That IMHO has unnecessary complexity, overhead and security implications.

It is ok to leave the RFC as is but it needs to be interpreted correctly for any compliance requirements.

Frankly, I think for compliance this should be treated as a *SHOULD* and not as a MUST.

>> 2.
>> TR1 transmits a Packet Too Big message to the NUT with an ICMPv6 Identifier does not match the Echo Reply in Step 1.
>> 
>> 3.
>> TR1 forwards an Echo Request from TN2 to the NUT.  The packet size is 1500 octets.
>> The NUT should respond without fragmenting the packet to the Echo Request using TR1 as a first hop.
>> 
>> We received a comment that this validation shouldn't apply to ICMPv6 and it should only apply to TCP or protocols that have state.   Do we think this only applies to TCP or is it valid for all traffic?
> 
> RFC8201 is a network layer mechanism, and the paragraph above applies to
> all packets sent by the node. Regardless of transport layer protocol.